#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

unsigned long long write_in_libc = 0x1111d0;
unsigned long long main_arena_in_libc = 0x1ebb80;

int main(int argc, char * argv[]) {	
	setbuf(stdout, NULL);

	unsigned long long libc_from_write = 0;
	unsigned long long libc_from_main_arena = 0;
	unsigned long long main_arena_leak = 0;
	
	libc_from_write = (unsigned long long)write - write_in_libc;
	main_arena_leak = (unsigned long long)write - write_in_libc + main_arena_in_libc;
	printf("write, libc, main_arena: %p, %p, %p\n", write, (void*)libc_from_write, (void*)main_arena_leak);

	unsigned long long * t[7];
	for(int i = 0; i < 7; i++) {
		t[i] = (unsigned long long *)malloc(0x100);
	}
	unsigned long long * a = (unsigned long long *)malloc(0x100);
	unsigned long long * b = (unsigned long long *)malloc(0x100);
	for(int i = 0; i < 7; i++) {
		free(t[i]);
	}
	free(a);
	unsigned long long * c = (unsigned long long *)malloc(0x40);
	unsigned long long * u = (unsigned long long *)((unsigned long long)c + 0x40);
	printf("c[0], c[1], c[2], c[3]: %p, %p, %p, %p\n", (void*)c[0], (void*)c[1], (void*)c[2], (void*)c[3]);
	printf("u[0], u[1], u[2], u[3]: %p, %p, %p, %p\n", (void*)u[0], (void*)u[1], (void*)u[2], (void*)u[3]);
	
	if(main_arena_leak == c[0] - 0x160){
		printf("success!\n");
	} else {
		printf("failed!\n");
	}

	if(main_arena_leak == u[2] - 0x60){
		printf("success!\n");
	} else {
		printf("failed!\n");
	}
	free(b);
	
	return 0;
}
